When Context Gets Root: Privilege Escalation in LLM Harnesses

2026-08-27

AI Summary

研究解决了LLM中由于上下文构建导致的指令特权提升问题，通过多代理机制在六个编码代理框架上实现了13个攻击目标。

Abstract

Instruction hierarchy is a model-side defense that assigns instructions different levels of privilege according to their sources. These levels constrain which content may direct model behavior. During agent execution, however, agent harnesses construct context for each model invocation. This construction can elevate low-level content to a higher instruction level and grant it greater model-facing privilege. We introduce instruction privilege escalation. In this attack, an attacker induces an agent to elevate low-level malicious content to a higher instruction level. The elevated content then causes the agent to execute instructions it would not follow at their original level. We evaluate this threat by using multi-agent mechanisms to achieve 13 attack objectives across six coding-agent harnesses. These objectives span confidentiality, integrity, availability, and remote code execution. With unrestricted action execution, the attacks achieve all 13 objectives on all six harnesses. Under automatic permission review, the attacks achieve all 13 objectives on all three harnesses that provide this mode. We further reproduce the vulnerability using harness-provided persistent goals and scheduled tasks. These results demonstrate the generality of instruction privilege escalation.

Problem

• instruction privilege escalation
• agent harnesses
• security threat
• context construction

Innovation

• instruction privilege escalation
• agent harnesses
• multi-agent mechanisms
• attack objectives